2

I have been following Gitlab's guide to enable Fast lookup of authorized SSH keys. Guide instructs to use AuthorizedKeysCommand. Authorized command is calling local https server. This command chain results to SELinux policy violation.

The error that I receive is following:

type=AVC msg=audit(1559126095.648:64173782): avc:  denied  { name_connect } for  pid=13839 comm="gitlab-shell-au" dest=8081 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket permissive=0

If I'm not mistaken, I need a custom SELinux policy. However, all guides that I could find are overly complex. Writing a policy file that allows this exception should be a trivial task.

Any ideas how a policy (.te) file that allows process with sshd_t to use transproxy_port_t should look like?

Edit. Gitlab does configure required policy, when running unicorn in standard port (8080)

  • 1
    a broader option may be semanage permissive -a sshd_t, to allow sshd_t to "escape" to (any) other contexts; just in case you find many successive hurdles in allowing one transition at a time via audit2allow – Jeff Schaller May 29 at 14:43
3

You can do this:

# generate the policy .te file
echo "type=AVC msg=audit(1559126095.648:64173782): avc:  denied  { name_connect } for  pid=13839 comm="gitlab-shell-au" dest=8081 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket permissive=0" | audit2allow -m gitlabfix1 > gitlabfix1.te

# create a module from the .te file
checkmodule -M -m -o gitlabfix1.mod gitlabfix1.te

# package it
semodule_package -o gitlabfix1.pp -m gitlabfix1.mod

# install it
semodule -i gitlabfix1.pp

There is a shorter way, but that won't create the .te intermediate file. The .te file is handy for archiving and understanding purposes :-).

The shorter way goes like this:

# generate the policy module package in one go
echo "type=AVC msg=audit(1559126095.648:64173782): avc:  denied  { name_connect } for  pid=13839 comm="gitlab-shell-au" dest=8081 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket permissive=0" | audit2allow -M gitlabfix2

# and load it
semodule -i gitlabfix2.pp

For educational purposes, the .te file looks like this:

module gitlabfix1 1.0;

require {
        type transproxy_port_t;
        type sshd_t;
        class tcp_socket name_connect;
}

#============= sshd_t ==============
allow sshd_t transproxy_port_t:tcp_socket name_connect;
  • We don't have audit2allow installed on all our hosts. So I created policy on identical system as .te and compiled it on target machine. You wouldn't know, if there is a way to tell, if compiled module and .te file differ? – Sami Korhonen May 31 at 7:23
  • 1
    If the OSes and SELinux policy versions are the same, a compiled module should load on all systems. Decompiling a module to get to a .te file is a nightmare but possible, for a good example see serverfault.com/questions/321301/… – Edward Jun 3 at 7:27
  • Right, it seems that I won't be bothered with that. Forcing the system to recompile the module whenever we run our (ansible) deployment would produce nearly identical results without sacrificing readability of the deployment code. – Sami Korhonen Jun 3 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.